Tessera
Folgen

Josh Bressers

@josh.bressers.name

Mostly on Mastodon - Open Source Security https://opensourcesecurity.io - Hacker History http://hackerhistory.com - He/Him

200 Posts421 Follower476 Folgt
Josh Bressers@josh.bressers.name · 2w ago

The first #CRA requirements started a few days ago. I chatted with Danial Thompson about what that means and what comes next Daniel has a ton of CRA knowledge, this first step isn't going to change a ton, but what's coming next will opensourcesecurity.io/2026/2026-09...

CRA vulnerability reporting with Daniel Thompson

Josh welcomes back Daniel Thompson to explain what just happened regarding vulnerability reporting and the CRA on September 11. The very first CRA requirements kicked in, but what does it really mean?...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 3w ago

I had a chat with Jaya Baloo from AISLE about why they seem to be finding vulnerabilities even when the new fancy tools aren't finding anything The answer is unsurprisingly "engineering" Jaya has a ton of interesting insight, including how to work with open source projects and what's coming next

Finding difficult vulnerabilities with Jaya Baloo from AISLE

Josh chats with Jaya Baloo from AISLE about their vulnerability scanner. If you follow open source vulnerabilities AISLE is a name you’ve seen popping up recently. They have a vulnerability scanner th...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 4w ago

I had a chat with Erik Möller from @sovereign.tech about what they're doing in the universe of funding open source Eric breaks down what they're doing, how it works, and how you can apply for funding. We even learn about some similar projects happening in the EU

Sovereign Tech Agency with Erik Möller

Episode Links Erik’s LinkedIn Sovereign Tech Agency Meet the First Sovereign Tech Standards Cohort Incident Report: unsanctioned agent behaviour during cyber testing STA on Mastodon This episode is al...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · last mo.

This week on #OpenSourceSecurity I had a chat with @paulasadoorian.bsky.social about a tool he wrote called Fettle and a report on CVEs he wrote We love making a huge deal about individual CVEs, but most of us have to deal with advisories that clump them together

CVEs vs Advisories with Paul Asadoorian

Josh chats with Paul Asadoorian about a tool he wrote called fettle and a recent report Paul published on CVEs. Fettle is a tool to help update and manage Linux systems. The big sell on this one is ch...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · last mo.

I had a chat with Erin Schnabel and Rob Nalen about a sustainability project between @commonhaus.org and HeroDevs The idea is to bring together the EOL business model from HeroDevs and use that to help further some of the Commonhaus software catalog

Maintaining EOL Open Source with Commonhaus and HeroDevs

Josh chats with Erin Schnabel and Rob Nalen about a new effort from Commonhaus and HeroDevs for maintaining end of life open source. This project, the Open Source Sustainability Initiative is a clever...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 2mo ago

This week on #OpenSourceSecurity I chat with @patrickmgarrity.bsky.social from @vulncheck.bsky.social about a report they wrote that looked at the number of actually exploited vulnerabilities The increase of CVEs is out of control, but the number of things that get exploited is flat

VulnCheck's State of Exploitation Report with Patrick Garrity

Josh chats with Patrick Garrity about the VulnCheck State of Exploitation 1H-2026 report. Patrick explains the current trends we are seeing around vulnerabilities right now. While the number of CVEs i...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 2mo ago

I had a chat with @joshcorman.bsky.social about securing critical infrastructure on #OSSPodcast Josh is one of the best in the industry on this topic. He has a ton of interesting (and sometimes scary) things to say about this opensourcesecurity.io/2026/2026-07...

Securing critical infrastructure with Josh Corman

Open Source Security welcomes Josh Corman to talk about the challenges around securing our critical infrastructure. Specifically the discussion centers around our water supplies. There are a lot of re...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 2mo ago

I chatted with Josh Marpet about a report his group, Value Chain Risk Institute, published showing the data behind open source dependencies It's not great, but having data that shows the problem is a big deal. There are a lot of opinions about open source and not a lot of data

Abandoned open source with Josh Marpet

Josh welcomes Josh Marpet for a discussion about abandoned open source packages. Josh Marpet has a foundation called Value Chain Risk Institute that has a report discussion how to start measuring if a...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 2mo ago

I got to chat with @mairin.bsky.social about Red Hat's Project Lightwell on #OpenSourceSecurity It's going to be interesting to figure out how everyone will start interacting with open source projects. This is something Red Hat is pretty good at already opensourcesecurity.io/2026/2026-07...

Red Hat's Project Lightwell with Mo Duffy

Josh welcomes Mo Duffy from Red Hat to chat about project Lightwell. The idea is to leverage the resources and understanding Red Hat has built up over the years to help deal with the deluge of vulnera...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 3mo ago

I had a chat with Lori Lorusso and Niko Matsakis about the Rust Foundation Maintainers Fund Funding open source is a huge topic right now, the Rust Foundation has some great ideas. It will be exciting to watch this one grow and evolve #OpenSourceSecurity #rust #RustFoundation

Rust Foundation Maintainers Fund with Lori and Niko

Josh chats with Lori Lorusso and Niko Matsakis about the Rust Foundation Maintainers Fund. This is a new project the Rust Foundation has create to help fund Rust maintainers. It’s a great discussion w...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 3mo ago

I had the pleasure to chat with @allanfriedman.bsky.social about Bill of Materials things on #OpenSourceSecurity We touched on SBOMs, HBOMs, AIBOMs, and even some other BOM types I can't remember now Allan is always fun to chat with, and he has encyclopedic knowledge about the BOM universe

AIBOM, CBOM, and HBOM with Allan Friedman

Josh chats with Allan Friedman about all things Bill of Materials. Allan did a ton of work to help turn SBOM into what it is today. He has many thoughts and ideas around the new types of BOMs, a conce...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 3mo ago

I had a chat with Jordi Boggiano from Packagist about a heap of security features they recently added and adding in the future The security of the public package repositories is a hot topic right now, Packagist is doing some really interesting things to improve their security

Packagist and Composer security with Jordi Boggiano

Josh welcomes Jordi Boggiano the lead maintainer of Composer and Packagist to explain the truckload of security features they’ve recently added. Packagist is the PHP package registry, Composer is the ...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 3mo ago

I had a chat on #OpenSourceSecurity with Mike Milinkovich and Thabang Mashologu from @eclipse.org about their new managed Open VSX registry The Eclipse Foundation has a plan that seems pretty sensible to keep the Open VSX registry around for a long time

Sustaining Open VSX with Mike and Thabang

Josh welcomes Mike Milinkovich and Thabang Mashologu from the Eclipse Foundation to talk about their new managed Open VSX registry. This is the first open source package registry to create a commercia...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 4mo ago

I had a chat with @francoisproulx.bsky.social about CI/CD security and a tool he built to red team your own pipelines. Holy cow this is a wild topic right now. I chatted with François a bit over a year ago before CI/CD lit on fire, his warnings were very apt opensourcesecurity.io/2026/2026-06...

Hacking your CI/CD with François Proulx

Josh welcomes back François Proulx to talk about the absolute madness in the CI/CD universe right now. We also learn about François’ new project SmokedMeat which is a tool to help you hack your own CI...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 5mo ago

I had a chat on #OpenSourceSecurity with Kat Cosgrove about open source being critical infrastructure Kat has a ton of experience in the world of Kubernetes and had some really interesting things to tell us about both successful projects as well as having to shut down projects

Open source is critical infrastructure with Kat Cosgrove

Josh talks to Kat Cosgrove about a how companies should be treating open source more like their critical infrastructure than free stuff. Kat has a ton of knowledge about how the interactions between c...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 5mo ago

The the wrap up with David Bernstein around how to test a disaster recovery / emergency response plan I'm pretty excited to get these out, it feels like this topic is more relevant than it's ever been and David does a nice job explaining it all opensourcesecurity.io/2026/2026-05...

How to actually test a disaster plan with David Bernstein

Josh and David finish up the disaster recovery and emergency planning trilogy. In this one David tells us how to test the plan he told us how to build in the last episode. There are some great ideas i...

opensourcesecurity.io

Miranda Heath@mirandaheath.website · 5mo ago

Some incredible in-depth discussion between @vlad.website and @josh.bressers.name on the importance (and challenges) of paying OSS maintainers in this episode of Open Source Security! (PS thanks for the shout-out ☀️) opensourcesecurity.io/2026/2026-04...

Open Source Pledge with Vlad-Stefan Harbuz

Josh has a discussion with Vlad-Stefan Harbuz about the Open Source Pledge as well as his recent FOSDEM talk. The Open Source Pledge is all about trying to build a sustainable universe for open source...

opensourcesecurity.io

Vlad-Stefan Harbuz 🌸@vlad.website · 5mo ago

I really enjoyed talking to @josh.bressers.name about the @opensourcepledge.com, and about why and how we should support Open Source maintainers 😊

Josh Bressers@josh.bressers.name · 5mo ago

I had a chat with @vlad.website about the @opensourcepledge.com Vlad has a ton of insight into how hard it is to just figure out what you're running plus the challenges maintainers have Vlad has a ton of great ideas how to start tackling some of these incredibly difficult problems

Josh Bressers@josh.bressers.name · 5mo ago

I had a chat with @vlad.website about the @opensourcepledge.com Vlad has a ton of insight into how hard it is to just figure out what you're running plus the challenges maintainers have Vlad has a ton of great ideas how to start tackling some of these incredibly difficult problems

Open Source Pledge with Vlad-Stefan Harbuz

Josh has a discussion with Vlad-Stefan Harbuz about the Open Source Pledge as well as his recent FOSDEM talk. The Open Source Pledge is all about trying to build a sustainable universe for open source...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 5mo ago

I had chat with David Bernstein about creating a disaster recovery plan on #OpenSourceSecurity With all the events unfolding almost every day lately, there's never been a better time to put a plan like this together. In a few weeks David will tell us how to test such a plan once we create it

Building a plan for disaster with David Bernstein

Josh welcomes back David Bernstein to talk about creating a disaster recover plan. It’s a very timely topic given all the current events. There are more supply chain attacks and compromises than ever ...

opensourcesecurity.io

Josh Bressers@josh.bressers.name · 5mo ago

A new #HackerHistory is out! This time we hear the story of Pyr0 Pyr0 tells us about a new upcoming conference all about hacker history, NaClCON Then we hear about a lot of awesome hacker history It's a great story! hackerhistory.com/podcast/the-...

The history of Pyr0 - Hacker History Podcast

Hacker History sits down with Luke McOmie, AKA Pyr0, to talk about a new conference about hacker history, as well as his history. Pyr0 tells us all about NaClCON. It's a conference dedicated to the st...

hackerhistory.com

Josh Bressers@josh.bressers.name · 6mo ago

I had a chat with Paul McCarty about his project @opensourcemalware.bsky.social Paul has a ton of great insight into what's happening with the massive influx of malware into our open source ecosystems opensourcesecurity.io/2026/2026-04...

Open Source Malware with Paul McCarty

Josh talks to Paul McCarty of Open Source Malware about … open source malware. Paul explains why there aren’t many good open source malware datasets. We discuss why the existing data is lacking for ma...

opensourcesecurity.io